8 ms·

I don't really get why one wants to trust ownCloud with private files: - "logging changes": https://github.com/owncloud/core/commit/eea96298951805dfc6eb9f58ccb

by scr4ve 11y ago

I don't really get why one wants to trust ownCloud with private files: - "logging changes": https://github.com/owncloud/core/commit/eea96298951805dfc6eb9f58ccb172b5a718e7e2 https://github.com/owncloud/core/commit/eea96298951805dfc6eb... vs https://owncloud.org/security/advisory/?id=oc-sa-2014-020 https://owncloud.org/security/advisory/?id=oc-sa-2014-020 - ownCloud is a PHP application with quite a few third-party modules of varying quality. Looking at the security history of Wordpress, it's not hard to imagine what's going to happen. - The maximum bug bounty for ownCloud is 500 USD. I think my data easily exceeds that. - From what I've heard, security fixes are provided to enterprise customers first, so if you're lucky your adversary is one of them and knows about vulnerabilities way ahead of you. To their credit, ownCloud openly publishes security advisories for every vulnerability, but I still think it's architecturally designed to fail. Exposing this to the internet is probably a bad idea. If you just need storage, you probably should just use dumb storage. If you need project management stuff and care about privacy, maybe look at https://protonet.info/ https://protonet.info/ or something along those lines. Also https://www.boxcryptor.com https://www.boxcryptor.com is really nice - the Dropbox desktop client does proper cert pinning (ownCloud doesn't) at least. Other than that, storage connected to a raspi via USB will probably yield rather bad transfer speeds?

kentonv 11y ago
If you're interested in something ownCloud-ish but with more security emphasis, you might like Sandstorm: https://sandstorm.io https://sandstorm.io https://docs.sandstorm.io/en/latest/developing/security-practices/ https://docs.sandstorm.io/en/latest/developing/security-prac... (Disclosure: I'm the lead developer.)
- middleclick 11y ago
  Can I use sandstorm without having a Google or GitHub account? EDIT: Thanks for the reply. Will check it out. And yes, I last gave it a try a while ago.
  - adrtessier 11y ago
    There's an email option as well. Check the demo, then choose "Create Account" - you'll see "with email" as an option, including an email field.
  - kentonv 11y ago
    Yes, of course. (It sounds like you might have tried a very early version a year or more ago... lots has changed since then.)
- adrtessier 11y ago
  Kenton, thanks for all of the work you and your contributors do on sandstorm.io; I have referred this project to many people wanting to get their feet wet "running a server" as a way to do something without instantly cutting yourself. Have you considered writing a how-to article on replicating ownCloud-like functionality within Sandstorm using apps? It might be a good first step, and I believe that it has the possibility to help people move onto (what I personally believe is) a superior platform.
  - kentonv 11y ago
    Well, mostly I see ownCloud as the good guys, and my hope is to have it available as a Sandstorm app soon. So I'd rather focus on replacing SaaS, like Google Docs/Drive. :) Here's a blog post about that: https://opensource.com/life/15/12/5-open-source-web-apps-self-hosted https://opensource.com/life/15/12/5-open-source-web-apps-sel...
  - ocdtrekkie 11y ago
    The biggest things I see ownCloud still having a huge advantage on is contacts and calendars, nobody's ported or written good apps for Sandstorm to do that yet. There's an awesome file storage app called Davros though, that's actually compatible with the ownCloud desktop client for file syncing!
- okigan 11y ago
  Unclear from the page, would it support SFTP, SMB protocols?
  - kentonv 11y ago
    At present, apps can implement HTTP and WebDAV APIs but not SFTP nor SMB. In the future we plan to generalize things so that apps could potentially implement any protocol, but we want to be careful to do it in a way that lets us keep our strong security guarantees.
- reitanqild 11y ago
  Happy user here. Sandstorm works amazingly well. Especially enjoy - the usability of Sandstorm, -it just works. - extensibility - you can adapt other apps, open source or commercial, to run on sandstorm. As far as I'm aware you can even upload them to the hosted version. - security seems to be taken good care of by pragmatic and experienced people. - the fact that I can pay a small amount monthly for it depending on my storage and computing needs, making sure incentives are aligned (although last time I checked I think Sandstorm hadn't even started the billing machine I think.) Furthermore it seems to be completely, real, free software, -I ran the OS version at a maching at home for months before oasis became available to me, and I haven't noticed any juicy parts missing or filed under "Enterprise only". The only difference between the versions seems to be the storage and compute resources available. (OK, the billing system doesn't seem to be in the Open Source version, but that is OK to me. : )
  - kentonv 11y ago
    Thanks for the kind words. :)
  - unixhero 11y ago
    +1
- kriro 11y ago
  AFAIK sandstorm self hosting only works on 64bit x86 machines and there's certain files I don't want hosted outside my own walls. The various ARMs are great for that use case, any future plans on supporting ARM? Otherwise sandstorm looks pretty great overall. I always appreciate a focus on security :)
  - ocdtrekkie 11y ago
    The primary problem with supporting ARM is that Sandstorm apps run native binaries. So in order to support ARM, every single Sandstorm app would need to be able to also be recompiled for ARM, or you end up fragmenting the ecosystem. I'm also not sure how many board PCs like a Raspberry Pi or what have you would handle Sandstorm well performance-wise, though I do think there's some 64-bit board PCs you can get now to try it on.
- JustSomeNobody 11y ago
  How well does this work with mobile? Are there mobile apps. I couldn't tell just clicking around.
  - ocdtrekkie 11y ago
    Sandstorm works decently on mobile browsers, they do test it. But how well different Sandstorm apps work on mobile depends on those apps. It's also possible to use native apps that sync to Sandstorm. My Tiny Tiny RSS instance on Sandstorm I can access through a native Android app, for instance.
    - JustSomeNobody 11y ago
      Oh, ok. I'll probably try and spin up a container or vm and install it and play around. Thanks!
- mkhpalm 11y ago
  Curious, why the scripts to install a simple series of binaries? If you packaged it natively then all the stuff you're doing with both GPG and install.sh simplifies dramatically from 2k lines of bash. With added benefit of pushing out security updates or releases becomes pretty simple.
  - kentonv 11y ago
    Bunch of reasons... - There is sadly no universal package manager on Linux. - A lot of that 2k-line bash script is implementing an interactive setup that configures your server, optionally claims a hostname and obtains SSL certificates, etc. A package manager wouldn't replace any of that. - Sandstorm's auto-updater will automatically update your server within 24 hours of any release. That's actually pretty hard to achieve with package managers. Most are not designed to auto-run in a cron job. Worse, many distros have long release cycles (6 months, 2 years, etc.) during which they only accept bugfixes. - Most package managers don't verify PGP signatures back to the upstream author, but rather to the distro maintainer (which in Debian's case is any one of thousands of people). It's debatable which is preferable, but note in any case that it's a very different property from what our installer implements. - Sandstorm self-containerizes in its own corner of the filesystem, basically avoiding any dependency on the rest of your system other than the kernel. This strategy works well for us -- it relieves us from having to test on every distro separately, and it avoids messing up the user's system -- but it probably wouldn't meet the guidelines required to get a package into a distro. So we'd still have to distribute our packages direct from our own server, or do a _lot_ more work. With all that said, when Sandstorm stabilizes more we do plan to figure out a way to let people "apt-get install sandstorm", since a lot of people are more comfortable with this.
- organian 11y ago
  Your project looks really exciting! I'd love to run it on my home server, any plans for supporting 32 bit servers?
  - kentonv 11y ago
    Unfortunately probably not any time soon, for the same reason as ARM: Sandstorm app packages include binaries built for x86-64. We'll need a lot of tooling to make it easy for developers to package for multiple architectures. :/
technion 11y ago
Owncloud wrote this blog some time back: > https://owncloud.org/blog/owncloud-and-php/ https://owncloud.org/blog/owncloud-and-php/ The discussions there around a "low barrier for entry" being a major goal of the project is, in my view, opposed to high levels of security. Edit: This quote showcases my point: “nobody will dig into a complex build system for a week before they send their first patch,”
- jospoortvliet 11y ago
  At the very least, yes, it makes it a lot harder. But, for many users, security is complicated and us making it easy to run ownCloud includes that. You won't find many competitors with such extensive documentation, nor automatic security setup tips and warnings in the ownCloud admin interface. Second, this is a matter of focus. For home and small server users, ease of use trumps perfect security, that is a simple risk model assumption: your security has to be good enough, not perfect. Better than others and all that. For enterprise users, however, security IS paramount and ownCloud lends itself for that. We get security audits by the financial institutions and others which run ownCloud and have extensive security hardening and best practices in place. Of course, these enterprise users don't use the many 'random' community apps, which is where the vast majority of security issues can be expected. I think that, for enterprise usage, you'll find that ownCloud security practice belongs to the best. And that is in no small part thanks to the awesome that is Lukas Reschke.
  - danieldk 11y ago
    For home and small server users, ease of use trumps perfect security, that is a simple risk model assumption: your security has to be good enough, not perfect. Better than others and all that. As someone else points out in a neighbouring thread, OwnCloud is generally less secure than any of the large services, because of automated vulnerability scanning. If an OwnCloud user updates their server days or even hours to late, it can be game over and your data is on the street. It does not matter if the attacked service is OwnCloud or some other service with enough privileges. This does not mean that open source and/or decentralized services are at a disadvantage, but you have to make the right security choices. The storage service[1] should never see unencrypted data - encryption at rest is not good enough. For instance, Bittorrent Sync provides this with their encrypted read-only keys. A cloud peer with such a key never sees unencrypted folder data. The only thing you lose when a cloud peer is hacked is a node in the swarm, but it'll never result in visibility of plain-text (unless you subvert AES-128). One SyncThing developer is currently also working on similar functionality for SyncThing. For this reason, I would never recommend OwnCloud to anyone outside a large company that has the capacity to do continuous security auditing and monitoring, unless you apply client-side encryption (but then you could use Dropbox et al. as well if privacy is the primary consideration). [1] I know that OwnCloud does more than just storage.
unethical_ban 11y ago
So an open source product with active and transparent security patching with a bug bounty isn't good enough? Yet you want to offer two closed-source alternatives. I am not defending Owncloud's record, I'm attacking your logic. A low-effort all-in-one groupware and private doc cloud (Google Apps replacement) is an awesome thing - if Owncloud could make deploying an email server as simple as the rest of its toolset, they will have hit the home run. And sandstorm.io - still waiting on internal user stores.
- middleclick 11y ago
  > internal user stores Can you please elaborate why this is a blocker for you since they offer email-based login?
  - unethical_ban 11y ago
    The entire premise of self-hosting is SELF hosting. Internal network, no operational, day-to-day necessity for Internet connectivity post-install. If I install such a product, it's because I want total control over my data and the terms by which I access it. Being forced to use Google/Github/email as auth goes against that.
- eeZi 11y ago
  His point is that a properly built proprietary product is better than a hacked together open source project. Active and transparent patching does not improve the code quality.
  - melted 11y ago
    How do you know a proprietary product is "properly built"?
    - jospoortvliet 11y ago
      Especially considering, unlike those proprietary products, our open source product and the engineers we pay to work on it are under constant and public scrutiny thanks to availability of the source. Honestly, I think you should not even consider trusting a proprietary product with your most important private data. There's no guarantee it isn't full of back doors and you can't audit the code or pay somebody to do it - some companies would even sue you if you try (see the Oracle debacle some weeks ago).
LukasReschke 11y ago
> logging changes "Please look at this commit so you know how you can hack us", sounds certainly like a much better idea ;-) > Security history at Wordpress When was there a single very grave vulnerability within the core of Wordpress? Mostly plugins are the root of all evil there. (besides the nasty XSS one in Jetpack, which was caused by a static HTML file) > - From what I've heard, security fixes are provided to enterprise customers first, so if you're lucky your adversary is one of them and knows about vulnerabilities way ahead of you. This is wrong. Until now there has not been a single moment where customers did receive patches in advance. The only difference being is that they see the advisories earlier, but at this moment patches are already available for all. > maximum bug bounty is $500 For the record we receiced until now 340 reports by over 150 individuals and until now only 1 vulnerability within the server has been pointed out. (Full Path Disclosure of the ownCloud root folder such as "/var/www") > If you need project management stuff and care about privacy, maybe look at https://protonet.info/ https://protonet.info/ or something along those lines What makes you thinl they are more secure? Note that most of the vulnerabilities within ownCloud are found internally: https://statuscode.ch/2015/09/ownCloud-security-development-over-the-years/ https://statuscode.ch/2015/09/ownCloud-security-development-... We could easily never have published any information as do a lot of other projects and companies.
- jessedhillon 11y ago
  When was there a single very grave vulnerability within the core of Wordpress? The list is current and very extensive: http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/ http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...
  - LukasReschke 11y ago
    So, if we ignore all lower and medium severity ones we're basically only left with CVE-2015-2213 which requires authentication. Also XSS is barely something one can blame PHP for. That's pretty low number. For the record: ownCloud protects you against XSS using Content-Security-Policy.
josteink 11y ago
> I don't really get why one wants to trust ownCloud with private files Because 1. You get to host and control the data, and have 100% access to the code managing that data. You don't have to trust anyone else for anything. 2. The chances of somebody attacking you (a small target) vs somebody attacking a big centralized service is fairly small. I'm not saying I believe Owncloud to be 100% secure (it being a semi-shoddy PHP application and all), but there are reasons someone may want to trust it over centralized, US-hosted and NSA-friendly online services.
- Pharaoh2 11y ago
  No. 2 is not right. For fingerprintable service with known exploits, dragnet type attacks are very common. If the GP is right about OwnCloud having a poorly written code base then you have a very high chance of getting hacked unless you can stay on top of updates, which is unlikely for most people. If your data is important enough that it needs to stay on self hosted machine, you should look at commercial solutions. Otherwise use dropbox/gdrive/s3 with self encrypted files.
  - jospoortvliet 11y ago
    But why would it be shoddy? We put a lot of effort in security and have a lot of people working on our code, with good automated testing and clear processes. See https://owncloud.org/security/ https://owncloud.org/security/ and https://doc.owncloud.org/server/9.0/developer_manual/general/codingguidelines.html#general https://doc.owncloud.org/server/9.0/developer_manual/general... We're a large project (often an order of magnitude larger than others trying something similar) and a company behind it with many large enterprise customers, which explains of course why we have good, transparent processes and dedicated security people. None of that has to lead to good code as a rule, I admit that. And there sure is lots of less than perfect code in ownCloud. But I don't think it is fair to just claim it is any more shoddy than any competitor without any evidence of that.
    - Pharaoh2 11y ago
      I am not claiming that owncloud is shoddy, I am just refuting the claim that somehow hosting your own server makes you a smaller target and somehow safer. Every code base eventually has security problems, sometime a big as heartbleed. If you are Amazon, you get a preferential disclosure and patches before it is publicly revealed. If you are John Doe, you better hope that you read the cve as soon as it's published and that you can patch the server right then.

by scr4ve 11y ago

kentonv 11y ago

If you're interested in something ownCloud-ish but with more security emphasis, you might like Sandstorm: https://sandstorm.io https://sandstorm.io https://docs.sandstorm.io/en/latest/developing/security-practices/ https://docs.sandstorm.io/en/latest/developing/security-prac... (Disclosure: I'm the lead developer.)

middleclick 11y ago
Can I use sandstorm without having a Google or GitHub account? EDIT: Thanks for the reply. Will check it out. And yes, I last gave it a try a while ago.
- adrtessier 11y ago
  There's an email option as well. Check the demo, then choose "Create Account" - you'll see "with email" as an option, including an email field.
- kentonv 11y ago
  Yes, of course. (It sounds like you might have tried a very early version a year or more ago... lots has changed since then.)
adrtessier 11y ago
Kenton, thanks for all of the work you and your contributors do on sandstorm.io; I have referred this project to many people wanting to get their feet wet "running a server" as a way to do something without instantly cutting yourself. Have you considered writing a how-to article on replicating ownCloud-like functionality within Sandstorm using apps? It might be a good first step, and I believe that it has the possibility to help people move onto (what I personally believe is) a superior platform.
- kentonv 11y ago
  Well, mostly I see ownCloud as the good guys, and my hope is to have it available as a Sandstorm app soon. So I'd rather focus on replacing SaaS, like Google Docs/Drive. :) Here's a blog post about that: https://opensource.com/life/15/12/5-open-source-web-apps-self-hosted https://opensource.com/life/15/12/5-open-source-web-apps-sel...
- ocdtrekkie 11y ago
  The biggest things I see ownCloud still having a huge advantage on is contacts and calendars, nobody's ported or written good apps for Sandstorm to do that yet. There's an awesome file storage app called Davros though, that's actually compatible with the ownCloud desktop client for file syncing!
okigan 11y ago
Unclear from the page, would it support SFTP, SMB protocols?
- kentonv 11y ago
  At present, apps can implement HTTP and WebDAV APIs but not SFTP nor SMB. In the future we plan to generalize things so that apps could potentially implement any protocol, but we want to be careful to do it in a way that lets us keep our strong security guarantees.
reitanqild 11y ago
Happy user here. Sandstorm works amazingly well. Especially enjoy - the usability of Sandstorm, -it just works. - extensibility - you can adapt other apps, open source or commercial, to run on sandstorm. As far as I'm aware you can even upload them to the hosted version. - security seems to be taken good care of by pragmatic and experienced people. - the fact that I can pay a small amount monthly for it depending on my storage and computing needs, making sure incentives are aligned (although last time I checked I think Sandstorm hadn't even started the billing machine I think.) Furthermore it seems to be completely, real, free software, -I ran the OS version at a maching at home for months before oasis became available to me, and I haven't noticed any juicy parts missing or filed under "Enterprise only". The only difference between the versions seems to be the storage and compute resources available. (OK, the billing system doesn't seem to be in the Open Source version, but that is OK to me. : )
- kentonv 11y ago
  Thanks for the kind words. :)
- unixhero 11y ago
  +1
kriro 11y ago
AFAIK sandstorm self hosting only works on 64bit x86 machines and there's certain files I don't want hosted outside my own walls. The various ARMs are great for that use case, any future plans on supporting ARM? Otherwise sandstorm looks pretty great overall. I always appreciate a focus on security :)
- ocdtrekkie 11y ago
  The primary problem with supporting ARM is that Sandstorm apps run native binaries. So in order to support ARM, every single Sandstorm app would need to be able to also be recompiled for ARM, or you end up fragmenting the ecosystem. I'm also not sure how many board PCs like a Raspberry Pi or what have you would handle Sandstorm well performance-wise, though I do think there's some 64-bit board PCs you can get now to try it on.
JustSomeNobody 11y ago
How well does this work with mobile? Are there mobile apps. I couldn't tell just clicking around.
- ocdtrekkie 11y ago
  Sandstorm works decently on mobile browsers, they do test it. But how well different Sandstorm apps work on mobile depends on those apps. It's also possible to use native apps that sync to Sandstorm. My Tiny Tiny RSS instance on Sandstorm I can access through a native Android app, for instance.
  - JustSomeNobody 11y ago
    Oh, ok. I'll probably try and spin up a container or vm and install it and play around. Thanks!
mkhpalm 11y ago
Curious, why the scripts to install a simple series of binaries? If you packaged it natively then all the stuff you're doing with both GPG and install.sh simplifies dramatically from 2k lines of bash. With added benefit of pushing out security updates or releases becomes pretty simple.
- kentonv 11y ago
  Bunch of reasons... - There is sadly no universal package manager on Linux. - A lot of that 2k-line bash script is implementing an interactive setup that configures your server, optionally claims a hostname and obtains SSL certificates, etc. A package manager wouldn't replace any of that. - Sandstorm's auto-updater will automatically update your server within 24 hours of any release. That's actually pretty hard to achieve with package managers. Most are not designed to auto-run in a cron job. Worse, many distros have long release cycles (6 months, 2 years, etc.) during which they only accept bugfixes. - Most package managers don't verify PGP signatures back to the upstream author, but rather to the distro maintainer (which in Debian's case is any one of thousands of people). It's debatable which is preferable, but note in any case that it's a very different property from what our installer implements. - Sandstorm self-containerizes in its own corner of the filesystem, basically avoiding any dependency on the rest of your system other than the kernel. This strategy works well for us -- it relieves us from having to test on every distro separately, and it avoids messing up the user's system -- but it probably wouldn't meet the guidelines required to get a package into a distro. So we'd still have to distribute our packages direct from our own server, or do a _lot_ more work. With all that said, when Sandstorm stabilizes more we do plan to figure out a way to let people "apt-get install sandstorm", since a lot of people are more comfortable with this.
organian 11y ago
Your project looks really exciting! I'd love to run it on my home server, any plans for supporting 32 bit servers?
- kentonv 11y ago
  Unfortunately probably not any time soon, for the same reason as ARM: Sandstorm app packages include binaries built for x86-64. We'll need a lot of tooling to make it easy for developers to package for multiple architectures. :/

technion 11y ago

Owncloud wrote this blog some time back: > https://owncloud.org/blog/owncloud-and-php/ https://owncloud.org/blog/owncloud-and-php/ The discussions there around a "low barrier for entry" being a major goal of the project is, in my view, opposed to high levels of security. Edit: This quote showcases my point: “nobody will dig into a complex build system for a week before they send their first patch,”

jospoortvliet 11y ago
At the very least, yes, it makes it a lot harder. But, for many users, security is complicated and us making it easy to run ownCloud includes that. You won't find many competitors with such extensive documentation, nor automatic security setup tips and warnings in the ownCloud admin interface. Second, this is a matter of focus. For home and small server users, ease of use trumps perfect security, that is a simple risk model assumption: your security has to be good enough, not perfect. Better than others and all that. For enterprise users, however, security IS paramount and ownCloud lends itself for that. We get security audits by the financial institutions and others which run ownCloud and have extensive security hardening and best practices in place. Of course, these enterprise users don't use the many 'random' community apps, which is where the vast majority of security issues can be expected. I think that, for enterprise usage, you'll find that ownCloud security practice belongs to the best. And that is in no small part thanks to the awesome that is Lukas Reschke.
- danieldk 11y ago
  For home and small server users, ease of use trumps perfect security, that is a simple risk model assumption: your security has to be good enough, not perfect. Better than others and all that. As someone else points out in a neighbouring thread, OwnCloud is generally less secure than any of the large services, because of automated vulnerability scanning. If an OwnCloud user updates their server days or even hours to late, it can be game over and your data is on the street. It does not matter if the attacked service is OwnCloud or some other service with enough privileges. This does not mean that open source and/or decentralized services are at a disadvantage, but you have to make the right security choices. The storage service[1] should never see unencrypted data - encryption at rest is not good enough. For instance, Bittorrent Sync provides this with their encrypted read-only keys. A cloud peer with such a key never sees unencrypted folder data. The only thing you lose when a cloud peer is hacked is a node in the swarm, but it'll never result in visibility of plain-text (unless you subvert AES-128). One SyncThing developer is currently also working on similar functionality for SyncThing. For this reason, I would never recommend OwnCloud to anyone outside a large company that has the capacity to do continuous security auditing and monitoring, unless you apply client-side encryption (but then you could use Dropbox et al. as well if privacy is the primary consideration). [1] I know that OwnCloud does more than just storage.

unethical_ban 11y ago

So an open source product with active and transparent security patching with a bug bounty isn't good enough? Yet you want to offer two closed-source alternatives. I am not defending Owncloud's record, I'm attacking your logic. A low-effort all-in-one groupware and private doc cloud (Google Apps replacement) is an awesome thing - if Owncloud could make deploying an email server as simple as the rest of its toolset, they will have hit the home run. And sandstorm.io - still waiting on internal user stores.

middleclick 11y ago
> internal user stores Can you please elaborate why this is a blocker for you since they offer email-based login?
- unethical_ban 11y ago
  The entire premise of self-hosting is SELF hosting. Internal network, no operational, day-to-day necessity for Internet connectivity post-install. If I install such a product, it's because I want total control over my data and the terms by which I access it. Being forced to use Google/Github/email as auth goes against that.
eeZi 11y ago
His point is that a properly built proprietary product is better than a hacked together open source project. Active and transparent patching does not improve the code quality.
- melted 11y ago
  How do you know a proprietary product is "properly built"?
  - jospoortvliet 11y ago
    Especially considering, unlike those proprietary products, our open source product and the engineers we pay to work on it are under constant and public scrutiny thanks to availability of the source. Honestly, I think you should not even consider trusting a proprietary product with your most important private data. There's no guarantee it isn't full of back doors and you can't audit the code or pay somebody to do it - some companies would even sue you if you try (see the Oracle debacle some weeks ago).

LukasReschke 11y ago

> logging changes "Please look at this commit so you know how you can hack us", sounds certainly like a much better idea ;-) > Security history at Wordpress When was there a single very grave vulnerability within the core of Wordpress? Mostly plugins are the root of all evil there. (besides the nasty XSS one in Jetpack, which was caused by a static HTML file) > - From what I've heard, security fixes are provided to enterprise customers first, so if you're lucky your adversary is one of them and knows about vulnerabilities way ahead of you. This is wrong. Until now there has not been a single moment where customers did receive patches in advance. The only difference being is that they see the advisories earlier, but at this moment patches are already available for all. > maximum bug bounty is $500 For the record we receiced until now 340 reports by over 150 individuals and until now only 1 vulnerability within the server has been pointed out. (Full Path Disclosure of the ownCloud root folder such as "/var/www") > If you need project management stuff and care about privacy, maybe look at https://protonet.info/ https://protonet.info/ or something along those lines What makes you thinl they are more secure? Note that most of the vulnerabilities within ownCloud are found internally: https://statuscode.ch/2015/09/ownCloud-security-development-over-the-years/ https://statuscode.ch/2015/09/ownCloud-security-development-... We could easily never have published any information as do a lot of other projects and companies.

jessedhillon 11y ago
When was there a single very grave vulnerability within the core of Wordpress? The list is current and very extensive: http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/ http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...
- LukasReschke 11y ago
  So, if we ignore all lower and medium severity ones we're basically only left with CVE-2015-2213 which requires authentication. Also XSS is barely something one can blame PHP for. That's pretty low number. For the record: ownCloud protects you against XSS using Content-Security-Policy.

josteink 11y ago

> I don't really get why one wants to trust ownCloud with private files Because 1. You get to host and control the data, and have 100% access to the code managing that data. You don't have to trust anyone else for anything. 2. The chances of somebody attacking you (a small target) vs somebody attacking a big centralized service is fairly small. I'm not saying I believe Owncloud to be 100% secure (it being a semi-shoddy PHP application and all), but there are reasons someone may want to trust it over centralized, US-hosted and NSA-friendly online services.

Pharaoh2 11y ago
No. 2 is not right. For fingerprintable service with known exploits, dragnet type attacks are very common. If the GP is right about OwnCloud having a poorly written code base then you have a very high chance of getting hacked unless you can stay on top of updates, which is unlikely for most people. If your data is important enough that it needs to stay on self hosted machine, you should look at commercial solutions. Otherwise use dropbox/gdrive/s3 with self encrypted files.
- jospoortvliet 11y ago
  But why would it be shoddy? We put a lot of effort in security and have a lot of people working on our code, with good automated testing and clear processes. See https://owncloud.org/security/ https://owncloud.org/security/ and https://doc.owncloud.org/server/9.0/developer_manual/general/codingguidelines.html#general https://doc.owncloud.org/server/9.0/developer_manual/general... We're a large project (often an order of magnitude larger than others trying something similar) and a company behind it with many large enterprise customers, which explains of course why we have good, transparent processes and dedicated security people. None of that has to lead to good code as a rule, I admit that. And there sure is lots of less than perfect code in ownCloud. But I don't think it is fair to just claim it is any more shoddy than any competitor without any evidence of that.
  - Pharaoh2 11y ago
    I am not claiming that owncloud is shoddy, I am just refuting the claim that somehow hosting your own server makes you a smaller target and somehow safer. Every code base eventually has security problems, sometime a big as heartbleed. If you are Amazon, you get a preferential disclosure and patches before it is publicly revealed. If you are John Doe, you better hope that you read the cve as soon as it's published and that you can patch the server right then.